Blog

IAM Consolidation

One of the most compelling talks I’ve seen was at BSides Las Vegas where they were describing malware techniques and adoption rates. They pointed out that there’s a wide variety of experimentation until they find something that works, and then...

Working with Okta and SAML integration

To get the slideshow/presentation that goes with this post, check here

Standup Week Of 02-22-2026

TODO this week:

Identity as Infrastructure

In thinking through different parts of key infrastructure in the modern IT landscape (storage, networking, compute), it strikes me that identity is another key part of that landscape. One could argue that identity falls under security and is already part...

How I Think the AI Bubble Deflates

So in looking at the AI bubble my thesis on how it deflates in the US is straightforward in that the uncapped exponential demand for AI comes up against the limitations of resources, both financial and physical leaving a few...

Some Thoughts on IAM

Delving a bit more into IAM I recently listed to the Identity at the Center podcast episode #399 with Jim McDonald and Jeff Margolies. Margolies is the Chief Product/Strategy Officer at Saviynt and was discussing identity in the age of...

Standup Week Of 02-15-2026

TODO this week: Finish Critical Analysis Project Take SC900 Educational Outreach

Learning more about IAM

In a Google Cloud Podcast from April of 2025, Henrique Teixeira, a Senior VP at Saviynt discussed where IAM started and where it’s going.

Standup Week Ending 02-08-2026

TODO this week:

Standup Week Ending 07-20-2025

Things accomplished this week:

Weekly Standup Week Ending 07-13-2025

What I got done this week:

WeeklyStandup

Sooooo here’s what I got done this week:

1-1-2024 - Data Engineering

Today was spent learning about data engineering and big data and taking notes on things like volume, velocity, and variety (and possibly veracity depending) as well distributed (horizontal) versus monolithic (vertical) systems. Additionally did some SQL work on SQL Bolt...

Day30-DEFCONInfiniteMoney

Today I started catching up on old DEFCON talks that I missed at DEFCON31 and the one I’ve enjoyed the most so far is the “Infinite Money” transit card hack by a team out of Boston. In it they describe...

Day29-HackingCapitalism

Continued working through Hacking Capitalism and finished a small OSINT project I’d been working on today that was harder than I though for various reasons from tracking things down to being able to correlate all the data.

Day28-HackingCapitalism

Today I went through and read more of Nova’s book about the tech industry and the ways that competition helps, and hurts various orgs and how to use it to your advantage. I know I want to give a talk...

Day26-AliceAndBobAppSecCh4

After taking some time away I read Alice and Bob Learn AppSec Chapter 4 and delved deeper into AuthZ and AuthN along with continued reinforcement of input validation, paramaterizing strings, session management, and validating inputs. Along with all of these...

Day25-AliceAndBobAppSecCh3

Today was reading through Chapter 3 of ALice and Bob learn Appsec and covering some straightforward security features like validate things client side, try and catch bugs/design issues early, keep secrets stored properly, use frameworks that are validated and verified...

Day24-AliceAndBobAppsecCH2

In addition to the SecKC meeting which covered new, cool people, and hacking satellites I also dove into Alice and Bob Learn Appsec chapter 2 (requirements) which went through HTTP headers, encryption, and how to check/utilize user inputs.

Day23-RefiningDataPipelineAndPresenting

Today I worked on further refining the data pipeline for the app I want to ulimately create, there’s soooo many different edge cases and things that can go wrong when you expect data or the call to be one way,...

Day21And22-CreatingADataPipeline

One of the things I’ve been curious about is application data/loading and seeing the process end to end, so for part of a weekend project I created an ETL pipeline. I started by using the NOAA/American Weather Service API since...

Day20-ForwardDefenseVersusPersistentEngagement

For today since I was still dealing with medical stuff, I decided to delve deeper into forward defense, persistent engagement, and deterrence. Largely working off of the article in 2019’s Journal of Cyber Security The Implications of Persistent and permanent...

Day19-CheapVSImposingCost

For day 19 I saw this article on the cost of committing cybercrime pop up on Hacker News. As such I started digging into the ideas of imposing costs in order to potentially deter cybercrime. The initial article that stood...

Day18-OWASPTop10

Today I started reading through the OWASP top 10 (2021) and also started going through the OWASP Top 10 section on THM. I think this weekend the goal is to get through the OWASP CTF Juice Shop.

Day17-FileUploadVulns

Went through more THM today covering file upload vulerabilities. Also read some more on SAST and DAST and the differences between them along with the difference(s) between AppSec and DevSecOps based on some further reading from a friend/co-worker.

Day16-HTTPAndCookies

For day 16 I covered HTTP status coded as well as cookies and key/value pairs to get out different results. Its also been fun learning different SAST/DAST/IAST tools along with getting to know the ins/outs of DevSecOps and AppSec with...

Day15-IDOR

Spent today on THM learning about IDOR or Insecure Direct Object References, which is just a fancy way of saying “users can input an identifier into the URL and see information they shouldn’t have access to”. I remember trying to...

Day13AndDay14

For day 13 Nova’s death was hitting me too hard so I took the day off from hacking. For day 14 I worked through more of THM’s Web App course focusing on Username Fuzzing, Password Fuzzing, Code and Cookie manipulation....

Day12-THM DNS Enumeration

Today I mostly went through more of THM’s Web App course focusing on enumeration through brute force, OSINT, or other methods to try and figure things out. I was surprised how easy certs are to look up/serach but I guess...

Day11-Manual,Automated,OSINT

Went through some more THM Web App today specifically going through their portion on finding and discovering different parts of the app via robots.txt, enumeration, and using GoBuster/Dirbuster and other tools to find logs, directories, and other sites that are...

Nóva

Nóva was a hacker’s hacker, a damn good person, and a better friend. She was also flighty as hell doing what she want, when she wanted, because it was her damn show. From her Mongolian singing bowls, to being a...

Day10-THM Burp Suite

Yesterday I went through a little bit more of THM’s Web App course and mostly focused on playing around and figuring out Burp Suite along with learning the HTML verbs etc…

Day10-THM + Alice and Bob Learn Appsec

Started out today with Chapter 2 of Alice and Bob Learn Appsec, and got about halfway through before my brain just wanted to stop reading and wouldn’t retain an additional information, so I switched tacs and started down Try Hack...

Day9-Alice and Bob Learn Appsec

Today I went through chapter 1 of Alice and Bob Learn Appsec by Tanya Janca and it was really good! It boiled down the key parts of security from MFA to security by obscurity, and the most important part: Don’t...

Day8-Appsec Pivot

So today I started reading Alice and Bob Learn Application Security by Tanya Janca with the most important lesson being: don’t trust anything outside of your own application. The reason for the pivot is twofold: 1. With where I’m at...

Day7-Bsides DEFCON and Recovering

I used to think the 3-2-1 rule was a joking suggestion, but after DEFCON I very much realized that it’s not. I spent most of the day still recovering from DEFCON/BSides and my week in Vegas. I learned a TON...

Day6-A Collection of Resources

For day 6 I opted to read the ICS Cyber Kill Chain (Assante, Lee, 2021, SANS) to get an opinion on how ICS attacks are carried out. While I agree with most of it in aggregate, I feel like only...

Day5-A Collection of Resources

For day 5 I opted to read a paper from SANS “An Abbreviated History of Automation and Industrial Controls System and Cybersecurity” (Hayden, 2015) that Rob suggested in the reading list. I found it fascinating how far back control systems...

Day4-A Collection of Resources

Yesterday and into this morning I watched Rob’s recommendation for the Dept Of Energy’s YouTube series on different clean energy systems and processes Energy 101. Watching through it it’s obvious that SCADA/OT will be at every step of the process...

Day3-A Collection of Resources

Sooooo today I started coming up with some project ideas, but also started reading a book that was on Rob’s resources list called “Industrial Control Systems Hacking Exposed” (McGraw Hill-2017, Bodungen, Singer, Shbeeb, Hilt, Wilholt) and got some fun stuff...

Day2-A Collection of Resources

SCADA Utility 101 - Rusty Williams

day1-A Collection of Resources

Summary of day 1 learning

Linux on a Chromebook Failed

Over the weekend I got a used Chromebook from a friend and wanted to turn it into a reasonably lightweight linux box. The thing I didn’t count on was UEFI and how much of a pain in the ass it...

updating Kali

So about a week ago now I was trying to install Ghidra on my Kali VM and found that when I was trying to $sudo apt get install ghidra that it would yell at me that where Kali was pointed...

IWC-CTF Writeup

Ironwood Cyber did a CTF on July 20th 2023 to get one of their delightful badges. The CTF consisted of 4 steps/challenges across various areas. Overall it was a fun CTF with a GREAT pivot after some of the infrastructure...

National Park Test Picture

Weird Cyber Publicity

A couple of (extended) publicity posts have come across my feed the first one is from the Shawn Ryan Show (Note: I think Ryan in general is in the vein of trying to embrace the “tacti-cool bro” part of ex-spec...

This is only a test

Only

C2 Learning

Started learning about C2 today because I’ve found C2s interesting for a while now and wanted to get a better grasp on them. Understanding the vocabulary and process of a C2 makes more sense now and one of the projects...

manualVSAutomated

While studying for the OSCP two terms kept confusing the hell out of me “Methodology” and “Enumeration” specifically “Manual Enumeration”. There wasn’t really a good glossary or definition on what those terms were or what they meant so I kind...

Review-PsychologyOfIntelAnalysis

Psychology of Intel Analysis by Heuer provides a good framework for analysts (not just intel analysts) to understand how they approach their craft, communicate their conclusions (internally and to the wider org), and think about what they do. Ultimately Heuer...

Working through THM Network Services

In the past few days I’ve been working through Try Hack Me’s Network services section and overall it’s a solid introduction to different services and the issues they can have along with how to enumerate services to figure out what’s...

THM Figuring out SSH

The other day I was doing a Try Hack Me Room for understanding common network services. I came across a part that I didn’t fully understand where we pull down an id_rsa ssh key, change the permissions on it, and...

WTF IS Enumeration

Enumeration

Scrumpdate 11-07-2022

HTB on shells

Scrumpdate 11-06-2022

Realized DST was a thing

Scrumpdate 11-04-2022

HTB nmap module

Scrumpdate 11-03-2022

HTB Nmap

scrumpdate 11-02-2022

More nmap research

Scrumpdate 11-01-2022

Updated base VM image to include common commands

Scrumpdate 10-31-2022

Finished Try Hack Me Nmap basics

Scrumpdate 10-30-2022

Review OSCP material

Scrumpdate 10-28-2022

Scrumpdate 10-28-2022

Scrumpdate 10-24-2022

Scrumpdate:

PhoenixCTF_Writeup

Had a blast at the PhoenixCTF and learned some valuable lessons from it.

scrumpdate 10-22-2022

Did Phoenix CTF

Scrumpdate 10-21-2022

Learned about Flipper Zero Botnet research CTF prep/studying

Scrumpdate 10-12-2022

Worked with Snort IDS

Josh Steinman Interview

I think that this interview with Josh Steinman is probably one of the most interesting I’ve come across in a while not just in terms of high level cybersecurity issues, but also in how Steinman approaches and operationalizes various issues....

Scrumpdate10-02-2022

Started Sec+ Resource gathering for testing

Scrumpdate09-25-2022

Scrumpdate:

Scrumpdate

Yesterday:

Welcome to Jekyll!

You’ll find this post in your _posts directory. Go ahead and edit it and re-build the site to see your changes. You can rebuild the site in many different ways, but the most common way is to run jekyll serve,...